skills/plugins/document-navigator/docs/security-stack/security/security-codes

@suaveplan/security-codes - Detect and sanitise sensitive security-code leakage in strings: API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, and more

Summary

Detect and sanitise sensitive security-code leakage in strings. Handles API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.

Documentation tree

• code-detector — (no submodules)
  • code-detector — (no submodules)
• code-sanitizer — (no submodules)
  • code-sanitizer — (no submodules)
• errors — (no submodules)
  • security-codes-error — (no submodules)
• aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
• credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
• entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
• github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
• google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
• jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
• openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
• pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
• ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
• stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
• types — (no submodules)
  • security-codes — (no submodules)
• utils — (no submodules)
  • luhn — (no submodules)

- [code-detector](./src/core/code-detector/code-detector.md) — _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — _(no submodules)_- [errors](./src/errors/security-codes-error.md) — _(no submodules)_- [security-codes-error](./src/errors/security-codes-error.md) — _(no submodules)_- [aws](./src/patterns/aws.md) — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…

• credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
• entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
• github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
• google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
• jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
• openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
• pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
• ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
• stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
• types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules)- code-sanitizer — (no submodules)- errors — (no submodules)- security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
• credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
• entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
• github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
• google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
• jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
• openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
• pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
• ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
• stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
• types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules)- code-sanitizer — (no submodules)- errors — (no submodules)- security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
• credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
• entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
• github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
• google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
• jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
• openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
• pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
• ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
• stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
• types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules) - code-sanitizer — (no submodules)- errors — (no submodules) - security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
• credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
• entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
• github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
• google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
• jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
• openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
• pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
• ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
• stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
• types — (no submodules) - security-codes — (no submodules)- utils — (no submodules) - luhn — (no submodules)

Features

• 10 built-in pattern detectors covering the most common secret types
• Pluggable detector API — register custom patterns at runtime
• 4 masking strategies — full-redact, partial, hash, tokenize
• Overlap deduplication — higher-confidence matches win
• OTel metrics — security_codes.detect.total and security_codes.detect.duration_ms
• Zero @suaveplan/ runtime dependencies* — leaf package, no circular risk

Install

bun add @suaveplan/security-codes

Quick Start

import { SecurityCodeDetector, SecurityCodeSanitizer } from '@suaveplan/security-codes';

const detector = new SecurityCodeDetector();
const matches = detector.detect('aws_key=AKIAIOSFODNN7EXAMPLE');

const sanitizer = new SecurityCodeSanitizer();
const { output } = sanitizer.sanitize('aws_key=AKIAIOSFODNN7EXAMPLE');
// output === 'aws_key=[REDACTED]'

Module Docs

• Types
• Luhn utility
• AWS pattern
• JWT pattern
• Stripe pattern
• GitHub pattern
• Google pattern
• OpenAI pattern
• Credit Card pattern
• PEM pattern
• SSH pattern
• Entropy pattern
• SecurityCodeDetector
• SecurityCodeSanitizer